Symmetric-key broadcast encryption: The multi-sender case

Abstract

The problem of (stateless, symmetric-key) broadcast encryption, in which a central authority distributes keys to a set of receivers and can then send encrypted content that can be decrypted only by a designated subset of those receivers, has received a significant amount of attention. Here, we consider a generalization of this problem in which all members of the group must have the ability to act as both sender and receiver. The parameters of interest are the number of keys stored per user and the bandwidth required per transmission, as a function of the total number of users n and the number of excluded/revoked users r. As our main result, we show a multi-sender scheme allowing revocation of an arbitrary number of users in which users store O(n) keys and the bandwidth is O(r). We prove a matching lower bound on the storage, showing that for schemes that support revocation of an arbitrary number of users Ω(n) keys are necessary for unique predecessor schemes, a class of schemes capturing most known constructions in the single-sender case. Previous work has shown that Ω(r) bandwidth is needed when the number of keys per user is polynomial, even in the single-sender case; thus, our scheme is optimal in both storage and bandwidth. We also show a scheme with storage polylog(n) and bandwidth O(r) that can be used to revoke any set of polylog(n) users.